Privacy policy

Controller

The controller responsible for your personal data is Itashu AB, registered in Sweden. You can contact us at jaro.rais@itashu.co.

Itashu AB, Järfälla, Sweden, company registration number 559516-0952.

What data we collect

Data you provide to us

• name, email address and company name, when you submit the contact form,
• messages and project descriptions you send us,
• email address and the language in which you signed up, when you subscribe to the newsletter,
• name, email and meeting time, when you book an appointment through the calendar,
• billing and payment details, when you order our services,
• email and company name, when you register for a webinar or download a whitepaper,

Data collected automatically

• cookies and similar technologies (see the Cookie policy),
• basic analytics data: pages visited, time on page, traffic source,
• device information: browser type, operating system, screen resolution,
• IP address (anonymized where possible). We use the country it comes from only to show you the Slovak or the English version of the Website; we do not store it for this.

We collect analytics and behavioral data only if you give your consent in the cookie banner. Without consent, measurement runs without cookies and without identifiers that could recognize you across visits.

How we use the data

• Form inquiries: to reply to you and discuss a possible collaboration (legal basis: legitimate interest).
• Consultation booking: to confirm and prepare the meeting (legal basis: steps prior to entering into a contract).
• Delivery of services: to perform the agreed scope, manage the project and invoice (legal basis: performance of a contract).
• Newsletter: to send you the content you requested. You confirm your subscription by clicking a link in an email; without confirmation you are not added to the list (legal basis: consent, which you can withdraw with one click in every email).
• Webinar and whitepaper: to send you access, the material and a reminder (legal basis: consent).
• Conversation with the assistant on the Website: to answer your questions and, on request, arrange a meeting (legal basis: steps prior to entering into a contract and legitimate interest).
• Website analytics: to understand how the Website is used and to improve it (legal basis: consent).
• Communication: to keep you informed about ongoing projects (legal basis: performance of a contract).

Who we share data with

We do not sell your personal data. We share it with the following processors:

• Vercel Inc.: Website hosting, content delivery, anonymous traffic measurement and page load speed measurement (without cookies).
• Google Ireland Ltd. (Google Analytics 4): traffic statistics, only with consent.
• Hotjar Ltd.: pseudonymized analysis of on-page behavior (without your name or email), only with consent.
• Resend Inc.: delivery of emails from the contact form and emails with requested materials.
• MailerLite (UAB MailerLite): newsletter subscription management, including confirmation and unsubscribing.
• Cal.com Inc.: booking of consultation appointments.
• Cloudflare Inc.: verification that a form is submitted by a human and not a bot.
• Accounting services: to the extent required by Swedish law.

All processors are bound by a data processing agreement and by the requirements of the GDPR.

How long we keep data

We keep personal data only for as long as necessary:

• contact form data: we do not store your message anywhere; it reaches us as an email. We keep it in our inbox for 12 months from the last communication. If a collaboration begins, the retention period for project data applies,
• project data: for the duration of the collaboration plus 7 years (Swedish accounting regulations),
• newsletter: until you unsubscribe,
• webinar and whitepaper registrations: until consent is withdrawn, for no longer than 24 months from registration,
• analytics data: 14 months. This is the longest option offered by the free version of Google Analytics.

Your rights

Under the GDPR, you have the right to:

• Access: request a copy of your personal data.
• Rectification: have inaccurate data corrected.
• Erasure: request deletion (the “right to be forgotten”).
• Restriction: restrict the processing of your data.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdrawal of consent: withdraw your consent at any time where processing is based on it.

You can exercise any of these rights by writing to jaro.rais@itashu.co. We will respond within 30 days.

Security

We use appropriate technical and organizational measures: an encrypted connection (HTTPS), secure hosting and controlled access. However, no transmission over the internet is one hundred percent secure.

Transfers outside the EU

Vercel, Cloudflare, Resend and Cal.com are companies based in the USA. Google Ireland Ltd. may make data available to its parent company Google LLC in the USA. Transfers to the USA are protected by an adequacy decision (the EU–US Data Privacy Framework) or standard contractual clauses, as required by the GDPR. MailerLite (Lithuania) and Hotjar (Malta) are based in the EU.

Children

Our Website and services are not intended for persons under the age of 16. We do not knowingly collect personal data from children.

Changes to this policy

We may update this policy from time to time. We will publish any changes on this page together with the new date of the update.

Complaints

If you believe that we are not handling your data properly, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.

Contact

Questions about data protection: jaro.rais@itashu.co

This document is available in Slovak and English. If the versions differ, the version in the language of our contract with you prevails; otherwise the English version prevails.